Check Point Zero-Day Exploited for Root Access

Check Point has released emergency hotfixes for a high-severity flaw exploited since late October to gain root privileges and establish persistence. Apply the hotfixes immediately and review CISA's BOD 26-04 guidance.

PostgreSQL Patches 52 Flaws Including 22-Year-Old RCE Bug

A type confusion flaw allows an authenticated database user to execute code on the server; updates fix it along with 51 other vulnerabilities. Rebuild any C-language extensions to fully protect against this flaw.

Google Chrome Critical Vulnerability (CVE-2026-126859)

A link-following flaw in Chrome prior to 157.0.8103.78 allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Update Chrome to the latest version immediately.

Linux Kernel Critical Vulnerability (CVE-2026-64530)

A use-after-free in the network scheduler (cls_api) can lead to memory corruption and potential privilege escalation. Apply the latest kernel updates to mitigate.

MongoDB Critical Use-After-Free (CVE-2026-118383)

A use-after-free in the replication component can cause server termination or potentially remote code execution when a newly elected primary completes catch-up. Update MongoDB Server to the latest patched version.

Multiple Products (Check Point)

Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server contain an incorrect permissions assignment for critical resources vulnerability when the Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.(2026-11-13)

UnrealIRCd (UnrealIRCd)

UnrealIRCd UnrealIRCd contains an improper neutralization of delimiters vulnerability that allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.(2026-11-13)

Microsoft Office / Microsoft 365 | High 8.8 | CVE-2026-116927

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

google chrome | Critical 9.6 | CVE-2026-126859

Link following in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

linux linux kernel | Critical 9.8 | CVE-2026-64530

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the defragmentation engine (e.g. act_ct on out-of-order fragments). When that…

Cisco BroadWorks | High 7.5 | CVE-2026-20320

A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to…

mongodb mongodb | Critical 9.5 | CVE-2026-118383

A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under…

AI Set to Revolutionize Ransomware Following Stagnant Few Years
TrendAI’s Bob McArdle said ransomware techniques will change significantly in the next year, with AI making attacks more dangerous and profitable (Unsourced)

FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls
The U.S. Federal Bureau of Investigation (FBI) has established that threat actors tied to the Democratic People's Republic of Korea (DPRK aka North Korea) have stolen more than $400 million worth of cryptocurrency as part of a social engineering [...] (The Hacker News)

German military drone operations disrupted by cyberattack
German defense technology company Quantum Systems confirmed that it detected an incident in late October that was part of an active cyberattack by "hostile actors." [...] (BleepingComputer)

SilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes and Spy on Taiwanese Users
A newly identified spying group used hacked equipment inside Asian mobile operators to intercept the calls and texts of selected people, mostly in Taiwan. Enea, a telecom and cybersecurity software company based in Stockholm, found the group's [...] (The Hacker News)

Check Point warns of zero-day flaw exploited for root access
Check Point Software has released emergency hotfixes to address a high-severity flaw that hackers have been exploiting to gain root privileges and establish persistence on vulnerable devices since late October. [...] (BleepingComputer)

New Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMs
Two attacks made public this week allow a malicious host to read data inside AMD SEV-SNP-protected virtual machines (VMs), which are built to keep the server's operator out. One of them, Mior, can also modify a VM's memory and fake the signed [...] (The Hacker News)

New SignDrop Exploit Can Abuse Windows Defender to Bypass Security Protections
SignDrop is a Windows zero-day that abuses CLFS security protections to let local attackers gain SYSTEM privileges and bypass defenses. The researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare, Nightmare-Eclipse, and [...] (Security Affairs)

PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE
A type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server. Updates released yesterday fix it, along with 51 other security flaws. Full protection from this flaw also requires rebuilding any C-language [...] (The Hacker News)

Gootloader Malware Disrupted After Infecting 25,000 Computers
International law enforcement disrupts Gootloader, seizing domains and taking down over 100 servers linked to 25,000 infected computers. The U.S. Department of Justice announced that law enforcement has removed Gootloader malware from more than 100 [...] (Security Affairs)

Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins
An international police operation took down servers behind Gootloader, CastleRAT and StealC this week. Criminals used the three malware tools to gain access to computers, steal passwords, and launch ransomware attacks. Police also seized about 6.4 [...] (The Hacker News)

🛡️ Wallstreet

Walgreen Co.

💀 play

ARRB Group  |  Frey Properties of Highland LLC

👁 Panzer

RE/MAX Germany

🛑 N0n

1 unnamed victim (identity not disclosed)

🐉 interlock

K&A Industries

⚠️ incransom

sportsmansguide.com  |  Advantage Archives

📛 everest

Final Notice Before Publication

👿 emperador

Carsem

🦇 Doommageddon

Koray Topaç Hukuk Bürosu

🐛 Dark Project

The CCMC

🐛 Curious Worm

2 unnamed victims (identity not disclosed)

🪼 bravox

World Wide Fittings

🏹 Aoqin

The Tidewater Inn

🔒 akira

Paragon Mechanical  |  Replogle Globes  |  Galorath